xref: /btstack/src/classic/avrcp_target.c (revision 46d6c6044a82d8cc98f35a2ca93e895adb50ca82)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_target.c"
39 
40 #include <stdint.h>
41 #include <stdio.h>
42 #include <string.h>
43 #include <inttypes.h>
44 
45 #include "classic/avrcp.h"
46 #include "classic/avrcp_target.h"
47 
48 #include "bluetooth_sdp.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_util.h"
52 #include "l2cap.h"
53 
54 #include <stdio.h>
55 #define AVRCP_ATTR_HEADER_LEN  8
56 
57 static const uint8_t AVRCP_NOTIFICATION_TRACK_SELECTED[] = {0,0,0,0,0,0,0,0};
58 static const uint8_t AVRCP_NOTIFICATION_TRACK_NOT_SELECTED[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
59 
60 avrcp_context_t avrcp_target_context;
61 
62 static uint32_t default_companies[] = {
63     0x581900 //BT SIG registered CompanyID
64 };
65 
66 static int avrcp_target_supports_browsing(uint16_t target_supported_features){
67     return target_supported_features & AVRCP_FEATURE_MASK_BROWSING;
68 }
69 
70 void avrcp_target_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
71     avrcp_create_sdp_record(0, service, service_record_handle, avrcp_target_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
72 }
73 
74 static void
75 avrcp_target_emit_operation(btstack_packet_handler_t callback, uint16_t avrcp_cid, avrcp_operation_id_t operation_id,
76                             bool button_pressed, uint8_t operands_length, uint8_t operand) {
77     btstack_assert(callback != NULL);
78 
79     uint8_t event[9];
80     int pos = 0;
81     event[pos++] = HCI_EVENT_AVRCP_META;
82     event[pos++] = sizeof(event) - 2;
83     event[pos++] = AVRCP_SUBEVENT_OPERATION;
84     little_endian_store_16(event, pos, avrcp_cid);
85     pos += 2;
86     event[pos++] = operation_id;
87     event[pos++] = button_pressed ? 1 : 0;
88     event[pos++] = operands_length;
89     event[pos++] = operand;
90     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
91 }
92 
93 static void avrcp_target_emit_volume_changed(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t absolute_volume){
94     btstack_assert(callback != NULL);
95 
96     uint8_t event[7];
97     int offset = 0;
98     event[offset++] = HCI_EVENT_AVRCP_META;
99     event[offset++] = sizeof(event) - 2;
100     event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
101     little_endian_store_16(event, offset, avrcp_cid);
102     offset += 2;
103     event[offset++] = AVRCP_CTYPE_NOTIFY;
104     event[offset++] = absolute_volume;
105     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
106 }
107 
108 static void avrcp_target_emit_respond_vendor_dependent_query(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t subevent_id){
109     btstack_assert(callback != NULL);
110 
111     uint8_t event[5];
112     int pos = 0;
113     event[pos++] = HCI_EVENT_AVRCP_META;
114     event[pos++] = sizeof(event) - 2;
115     event[pos++] = subevent_id;
116     little_endian_store_16(event, pos, avrcp_cid);
117     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
118 }
119 
120 // returns number of bytes stored
121 static uint16_t avrcp_target_pack_single_element_header(uint8_t * buffer, avrcp_media_attribute_id_t attr_id, uint16_t attr_value_size){
122     btstack_assert(attr_id > AVRCP_MEDIA_ATTR_ALL);
123     btstack_assert(attr_id < AVRCP_MEDIA_ATTR_RESERVED);
124     uint16_t pos = 0;
125     big_endian_store_32(buffer, pos, attr_id);
126     big_endian_store_16(buffer, pos + 4, RFC2978_CHARSET_MIB_UTF8);
127     big_endian_store_16(buffer, pos + 6, attr_value_size);
128     return 8;
129 }
130 
131 static uint16_t avrcp_now_playing_info_attr_id_value_len(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id){
132     char buffer[AVRCP_MAX_ATTRIBUTE_SIZE];
133     uint16_t str_len;
134     switch (attr_id) {
135         case AVRCP_MEDIA_ATTR_ALL:
136         case AVRCP_MEDIA_ATTR_NONE:
137             return 0;
138         case AVRCP_MEDIA_ATTR_TRACK:
139             str_len = sprintf(buffer, "%0" PRIu32, connection->target_track_nr);
140             break;
141         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
142             str_len = sprintf(buffer, "%0" PRIu32, connection->target_total_tracks);
143             break;
144         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
145             str_len = sprintf(buffer, "%0" PRIu32, connection->target_song_length_ms);
146             break;
147         default:
148             str_len = connection->target_now_playing_info[(uint16_t)attr_id - 1].len;
149             break;
150     }
151     return str_len;
152 }
153 
154 static uint16_t avrcp_now_playing_info_value_len_with_headers(avrcp_connection_t * connection){
155     uint16_t playing_info_len = 0;
156 
157     uint8_t i;
158     for ( i = (uint8_t)AVRCP_MEDIA_ATTR_ALL + 1; i < (uint8_t) AVRCP_MEDIA_ATTR_RESERVED; i++){
159         avrcp_media_attribute_id_t attr_id = (avrcp_media_attribute_id_t) i;
160 
161         if ((connection->target_now_playing_info_attr_bitmap & (1 << attr_id)) == 0) {
162             continue;
163         }
164 
165         switch (attr_id) {
166             case AVRCP_MEDIA_ATTR_ALL:
167             case AVRCP_MEDIA_ATTR_NONE:
168             case AVRCP_MEDIA_ATTR_DEFAULT_COVER_ART:
169                 break;
170             default:
171                 playing_info_len += AVRCP_ATTR_HEADER_LEN + avrcp_now_playing_info_attr_id_value_len(connection, attr_id);
172                 break;
173         }
174     }
175     // for total num bytes that of the attributes + headers
176     playing_info_len += 1;
177     return playing_info_len;
178 }
179 
180 static uint8_t * avrcp_get_attribute_value_from_u32(avrcp_connection_t * connection, uint32_t value, uint16_t * num_bytes_to_copy){
181     *num_bytes_to_copy = 0;
182 
183     if (connection->attribute_value_len == 0){
184         connection->attribute_value_len = sprintf((char *)connection->attribute_value, "%0" PRIu32, value);
185         connection->attribute_value_offset = 0;
186     }
187     *num_bytes_to_copy = connection->attribute_value_len - connection->attribute_value_offset;
188     return connection->attribute_value + connection->attribute_value_offset;
189 }
190 
191 static uint8_t * avrcp_get_next_value_fragment_for_attribute_id(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id, uint16_t * num_bytes_to_copy){
192     switch (attr_id){
193         case AVRCP_MEDIA_ATTR_TRACK:
194             return avrcp_get_attribute_value_from_u32(connection, connection->target_track_nr, num_bytes_to_copy);
195         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
196             return avrcp_get_attribute_value_from_u32(connection, connection->target_total_tracks, num_bytes_to_copy);
197         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
198             return avrcp_get_attribute_value_from_u32(connection, connection->target_song_length_ms, num_bytes_to_copy);
199         default:
200             break;
201     }
202     int attr_index = attr_id - 1;
203     if (connection->attribute_value_len == 0){
204         connection->attribute_value_len = avrcp_now_playing_info_attr_id_value_len(connection, attr_id);
205         connection->attribute_value_offset = 0;
206     }
207     *num_bytes_to_copy = connection->target_now_playing_info[attr_index].len - connection->attribute_value_offset;
208     return (uint8_t *) (connection->target_now_playing_info[attr_index].value + connection->attribute_value_offset);
209 }
210 
211 // TODO Review
212 static uint16_t avrcp_store_avctp_now_playing_info_fragment(avrcp_connection_t * connection, uint16_t packet_size, uint8_t * packet){
213     uint16_t num_free_bytes = packet_size;
214 
215     uint16_t bytes_stored = 0;
216 
217     while ((num_free_bytes > 0) && (connection->next_attr_id <= AVRCP_MEDIA_ATTR_SONG_LENGTH_MS)){
218         if ((connection->target_now_playing_info_attr_bitmap & (1 << (uint8_t)connection->next_attr_id)) == 0) {
219             connection->next_attr_id = (avrcp_media_attribute_id_t) (((int) connection->next_attr_id) + 1);
220             continue;
221         }
222 
223         // prepare attribute value
224         uint16_t num_bytes_to_copy;
225         uint8_t * attr_value_with_offset = avrcp_get_next_value_fragment_for_attribute_id(connection,
226                                                                                           connection->next_attr_id,
227                                                                                           &num_bytes_to_copy);
228 
229         // store header
230         if (connection->attribute_value_offset == 0){
231             // pack the whole attribute value header
232             if (connection->parser_attribute_header_pos == 0) {
233                 avrcp_target_pack_single_element_header(connection->parser_attribute_header, connection->next_attr_id,
234                                                         connection->attribute_value_len);
235             }
236         }
237 
238         if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN){
239             uint16_t num_header_bytes_to_store = btstack_min(num_free_bytes, AVRCP_ATTRIBUTE_HEADER_LEN - connection->parser_attribute_header_pos);
240             memcpy(packet + bytes_stored, connection->parser_attribute_header + connection->parser_attribute_header_pos, num_header_bytes_to_store);
241             connection->parser_attribute_header_pos += num_header_bytes_to_store;
242             bytes_stored += num_header_bytes_to_store;
243             num_free_bytes -= num_header_bytes_to_store;
244             connection->data_offset += num_header_bytes_to_store;
245 
246             if (num_free_bytes == 0){
247                 continue;
248             }
249         }
250 
251         // store value
252         uint16_t num_attr_value_bytes_to_store = btstack_min(num_free_bytes, connection->attribute_value_len - connection->attribute_value_offset);
253         memcpy(packet + bytes_stored, attr_value_with_offset, num_attr_value_bytes_to_store);
254         bytes_stored   += num_attr_value_bytes_to_store;
255         num_free_bytes -= num_attr_value_bytes_to_store;
256         connection->attribute_value_offset += num_attr_value_bytes_to_store;
257         connection->data_offset += num_attr_value_bytes_to_store;
258 
259         if (connection->attribute_value_offset == connection->attribute_value_len){
260             // C++ compatible version of connection->next_attr_id++
261             connection->next_attr_id = (avrcp_media_attribute_id_t) (((int) connection->next_attr_id) + 1);
262             connection->attribute_value_offset = 0;
263             connection->attribute_value_len = 0;
264             connection->parser_attribute_header_pos = 0;
265         }
266     }
267     return bytes_stored;
268 }
269 
270 static void avrcp_send_response_with_avctp_fragmentation(avrcp_connection_t * connection){
271     l2cap_reserve_packet_buffer();
272     uint8_t * packet = l2cap_get_outgoing_buffer();
273 
274     // transport header
275     // Transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
276 
277     uint16_t max_payload_size;
278     connection->avctp_packet_type = avctp_get_packet_type(connection, &max_payload_size);
279     connection->avrcp_packet_type = avrcp_get_packet_type(connection);
280 
281     // AVCTP header
282     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
283     uint16_t pos = 0;
284     packet[pos++] = (connection->transaction_id << 4) | (connection->avctp_packet_type << 2) | (AVRCP_RESPONSE_FRAME << 1) | 0;
285 
286     uint16_t param_len = connection->data_len;
287 
288     if (connection->avctp_packet_type == AVCTP_START_PACKET){
289         uint16_t max_frame_size = btstack_min(connection->l2cap_mtu, AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
290         // first packet: max_payload_size
291         // rest packets
292         uint16_t num_payload_bytes = param_len - max_payload_size;
293         uint16_t frame_size_for_continue_packet = max_frame_size - avctp_get_num_bytes_for_header(AVCTP_CONTINUE_PACKET);
294         uint16_t num_avctp_packets = (num_payload_bytes + frame_size_for_continue_packet - 1)/frame_size_for_continue_packet + 1;
295         packet[pos++] = num_avctp_packets;
296     }
297 
298     uint16_t bytes_stored = 0;
299     uint8_t i;
300 
301     switch (connection->avctp_packet_type) {
302         case AVCTP_SINGLE_PACKET:
303         case AVCTP_START_PACKET:
304             // Profile IDentifier (PID)
305             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
306             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
307 
308             // AVRCP message
309             // command_type
310             packet[pos++] = connection->command_type;
311             // subunit_type | subunit ID
312             packet[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
313             // opcode
314             packet[pos++] = (uint8_t) connection->command_opcode;
315 
316             switch (connection->command_opcode) {
317                 case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
318                     big_endian_store_24(packet, pos, connection->company_id);
319                     pos += 3;
320                     packet[pos++] = connection->pdu_id;
321                     // AVRCP packet type
322 
323                     packet[pos++] = (uint8_t)connection->avrcp_packet_type;
324                     // parameter length
325                     big_endian_store_16(packet, pos, param_len);
326                     pos += 2;
327 
328                     switch (connection->pdu_id) {
329                         // message is small enough to fit the single packet, no need for extra check
330                         case AVRCP_PDU_ID_GET_CAPABILITIES:
331                             // capability ID
332                             packet[pos++] = connection->data[0];
333                             // num_capabilities
334                             packet[pos++] = connection->data[1];
335 
336                             switch ((avrcp_capability_id_t) connection->data[0]) {
337                                 case AVRCP_CAPABILITY_ID_EVENT:
338                                     for (i = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX;
339                                          i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++) {
340                                         if ((connection->notifications_supported_by_target & (1 << i)) == 0) {
341                                             continue;
342                                         }
343                                         packet[pos++] = i;
344                                     }
345                                     break;
346                                 case AVRCP_CAPABILITY_ID_COMPANY:
347                                     // use Bluetooth SIG as default company
348                                     for (i = 0; i < connection->data[1]; i++) {
349                                         little_endian_store_24(packet, pos,
350                                                                connection->target_supported_companies[i]);
351                                         pos += 3;
352                                     }
353                                     break;
354                                 default:
355                                     // error response
356                                     break;
357                             }
358                             l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
359                             return;
360 
361                         case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
362                             packet[pos++] = count_set_bits_uint32(connection->target_now_playing_info_attr_bitmap);
363                             max_payload_size--;
364 
365                             bytes_stored = avrcp_store_avctp_now_playing_info_fragment(connection, max_payload_size, packet + pos);
366 
367                             connection->avrcp_frame_bytes_sent += bytes_stored + pos;
368                             l2cap_send_prepared(connection->l2cap_signaling_cid, pos + bytes_stored);
369                             return;
370 
371                         default:
372                             // error response and other OPCODEs
373                             break;
374                     }
375                     break;
376 
377                 case AVRCP_CMD_OPCODE_PASS_THROUGH:
378                     packet[pos++] = connection->operation_id;
379                     // parameter length
380                     packet[pos++] = (uint8_t) connection->data_len;
381                     pos += 2;
382                     break;
383                 case AVRCP_CMD_OPCODE_UNIT_INFO:
384                     break;
385                 case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
386                     break;
387                 default:
388                     btstack_assert(false);
389                     return;
390             }
391             break;
392         case AVCTP_CONTINUE_PACKET:
393         case AVCTP_END_PACKET:
394             switch (connection->pdu_id) {
395                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
396                     bytes_stored = avrcp_store_avctp_now_playing_info_fragment(connection, max_payload_size, packet + pos);
397 
398                     connection->avrcp_frame_bytes_sent += bytes_stored + pos;
399                     l2cap_send_prepared(connection->l2cap_signaling_cid, pos + bytes_stored);
400                     return;
401 
402                 default:
403                     break;
404             }
405             break;
406         default:
407             btstack_assert(false);
408             return;
409     }
410 
411     // compare number of bytes to store with the remaining buffer size
412     uint16_t bytes_to_copy = btstack_min(connection->data_len - connection->data_offset, max_payload_size - pos);
413 
414     (void)memcpy(packet + pos, &connection->data[connection->data_offset], bytes_to_copy);
415     pos += bytes_to_copy;
416     connection->data_offset += bytes_to_copy;
417     connection->avrcp_frame_bytes_sent += pos;
418 
419     l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
420 }
421 
422 static void avctp_send_reject_cmd_wrong_pid(avrcp_connection_t * connection){
423     l2cap_reserve_packet_buffer();
424     uint8_t * packet = l2cap_get_outgoing_buffer();
425 
426     // AVCTP header
427     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
428     packet[0] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_RESPONSE_FRAME << 1) | 1;
429     big_endian_store_16(packet, 1, connection->message_body[0]);
430     l2cap_send_prepared(connection->l2cap_signaling_cid, 3);
431 }
432 
433 static void avrcp_target_custom_command_data_init(avrcp_connection_t * connection,
434     avrcp_command_opcode_t opcode, avrcp_command_type_t command_type,
435     avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
436     avrcp_pdu_id_t pdu_id, uint32_t company_id){
437 
438     connection->command_opcode = opcode;
439     connection->command_type = command_type;
440     connection->subunit_type = subunit_type;
441     connection->subunit_id = subunit_id;
442     connection->company_id = company_id << 16;
443     connection->pdu_id = pdu_id;
444     connection->data = NULL;
445     connection->data_offset = 0;
446     connection->data_len = 0;
447     connection->avrcp_frame_bytes_sent = 0;
448 }
449 
450 static void avrcp_target_vendor_dependent_response_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_pdu_id_t pdu_id){
451     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
452     connection->subunit_type   = AVRCP_SUBUNIT_TYPE_PANEL;
453     connection->subunit_id     = AVRCP_SUBUNIT_ID;
454     connection->company_id     = BT_SIG_COMPANY_ID;
455 
456     connection->command_type = command_type;
457     connection->pdu_id = pdu_id;
458     connection->data = connection->message_body;
459     connection->data_offset = 0;
460     connection->data_len = 0;
461     connection->avrcp_frame_bytes_sent = 0;
462 }
463 
464 static void avrcp_target_pass_through_command_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_operation_id_t opid){
465     connection->command_opcode = AVRCP_CMD_OPCODE_PASS_THROUGH;
466     connection->subunit_type   = AVRCP_SUBUNIT_TYPE_PANEL;
467     connection->subunit_id     = AVRCP_SUBUNIT_ID;
468 
469     connection->command_type = command_type;
470     connection->company_id = 0;
471     connection->pdu_id = AVRCP_PDU_ID_UNDEFINED;
472     connection->operation_id = opid;
473 
474     connection->data = connection->message_body;
475     connection->data_offset = 0;
476     connection->data_len = 0;
477     connection->avrcp_frame_bytes_sent = 0;
478 }
479 
480 
481 static uint8_t avrcp_target_vendor_dependent_response_accept(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t status){
482     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, pdu_id);
483     connection->data_len = 1;
484     connection->data[0] = status;
485 
486     connection->target_accept_response = true;
487     connection->state = AVCTP_W2_SEND_RESPONSE;
488     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
489     return ERROR_CODE_SUCCESS;
490 }
491 
492 static uint8_t avrcp_target_response_vendor_dependent_reject(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, avrcp_status_code_t status){
493     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_REJECTED, pdu_id);
494     connection->data_len = 1;
495     connection->data[0] = status;
496 
497     connection->state = AVCTP_W2_SEND_RESPONSE;
498     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
499     return ERROR_CODE_SUCCESS;
500 }
501 
502 static uint8_t avrcp_target_response_vendor_dependent_not_implemented(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id){
503     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_NOT_IMPLEMENTED, pdu_id);
504     connection->data_len = 1;
505     connection->data[0] = event_id;
506 
507     connection->state = AVCTP_W2_SEND_RESPONSE;
508     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
509     return ERROR_CODE_SUCCESS;
510 }
511 
512 static uint8_t avrcp_target_response_vendor_dependent_interim(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id, const uint8_t * value, uint16_t value_len){
513     btstack_assert(value_len + 1 < AVRCP_MAX_COMMAND_PARAMETER_LENGTH);
514     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_INTERIM, pdu_id);
515     connection->data_len = 1 + value_len;
516     connection->data[0] = event_id;
517 
518     if (value && (value_len > 0)){
519         (void)memcpy(connection->data + 1, value, value_len);
520     }
521 
522     connection->state = AVCTP_W2_SEND_RESPONSE;
523     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
524     return ERROR_CODE_SUCCESS;
525 }
526 
527 static uint8_t avrcp_target_response_addressed_player_changed_interim(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id){
528     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_INTERIM, pdu_id);
529 
530     connection->data_len = 5;
531     connection->data[0] = event_id;
532     big_endian_store_16(connection->data, 1, connection->target_addressed_player_id);
533     big_endian_store_16(connection->data, 3, connection->target_uid_counter);
534 
535     connection->state = AVCTP_W2_SEND_RESPONSE;
536     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
537     return ERROR_CODE_SUCCESS;
538 }
539 
540 static uint8_t avrcp_target_pass_through_response(uint16_t avrcp_cid, avrcp_command_type_t ctype, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
541     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
542     if (!connection){
543         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
544     }
545     avrcp_target_pass_through_command_data_init(connection, ctype, opid);
546 
547     if (operands_length == 1){
548         connection->data_len = 1;
549         connection->message_body[0] = operand;
550     }
551 
552     connection->state = AVCTP_W2_SEND_RESPONSE;
553     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
554     return ERROR_CODE_SUCCESS;
555 }
556 
557 uint8_t avrcp_target_operation_rejected(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
558     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_REJECTED, opid, operands_length, operand);
559 }
560 
561 uint8_t avrcp_target_operation_accepted(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
562     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_ACCEPTED, opid, operands_length, operand);
563 }
564 
565 uint8_t avrcp_target_operation_not_implemented(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
566     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_ACCEPTED, opid, operands_length, operand);
567 }
568 
569 uint8_t avrcp_target_set_unit_info(uint16_t avrcp_cid, avrcp_subunit_type_t unit_type, uint32_t company_id){
570     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
571     if (!connection){
572         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
573     }
574     connection->target_unit_type = unit_type;
575     connection->company_id = company_id;
576     return ERROR_CODE_SUCCESS;
577 }
578 
579 uint8_t avrcp_target_set_subunit_info(uint16_t avrcp_cid, avrcp_subunit_type_t subunit_type, const uint8_t * subunit_info_data, uint16_t subunit_info_data_size){
580     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
581     if (!connection){
582         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
583     }
584     connection->target_subunit_info_type = subunit_type;
585     connection->target_subunit_info_data = subunit_info_data;
586     connection->target_subunit_info_data_size = subunit_info_data_size;
587     return ERROR_CODE_SUCCESS;
588 }
589 
590 static uint8_t avrcp_target_unit_info(avrcp_connection_t * connection){
591     if (connection->state != AVCTP_CONNECTION_OPENED){
592         return ERROR_CODE_COMMAND_DISALLOWED;
593     }
594 
595     avrcp_target_custom_command_data_init(connection,
596                                           AVRCP_CMD_OPCODE_UNIT_INFO, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE,
597                                           AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
598                                           connection->company_id);
599 
600     uint8_t unit = 0;
601     connection->data = connection->message_body;
602     connection->data_len = 5;
603     connection->data[0] = 0x07;
604     connection->data[1] = (connection->target_unit_type << 4) | unit;
605     // company id is 3 bytes long
606     big_endian_store_24(connection->data, 2, connection->company_id);
607 
608     connection->state = AVCTP_W2_SEND_RESPONSE;
609     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
610     return ERROR_CODE_SUCCESS;
611 }
612 
613 static uint8_t avrcp_target_subunit_info(avrcp_connection_t * connection, uint8_t offset){
614     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
615     if (offset >= 32) return AVRCP_STATUS_INVALID_PARAMETER;
616 
617     avrcp_target_custom_command_data_init(connection, AVRCP_CMD_OPCODE_SUBUNIT_INFO,
618                                           AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE,
619                                           AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
620                                           connection->company_id);
621 
622     uint8_t page = offset / 4;
623     uint8_t extension_code = 7;
624     connection->data = connection->message_body;
625     connection->data_len = 5;
626     connection->data[0] = (page << 4) | extension_code;
627 
628     // mark non-existent entries with 0xff
629     memset(&connection->message_body[1], 0xFF, 4);
630     if ((connection->data != NULL) && (offset < connection->target_subunit_info_data_size)){
631         uint8_t bytes_to_copy = btstack_min(connection->target_subunit_info_data_size - offset, 4);
632         memcpy(&connection->data[1], &connection->target_subunit_info_data[offset], bytes_to_copy);
633     }
634 
635     connection->state = AVCTP_W2_SEND_RESPONSE;
636     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
637     return ERROR_CODE_SUCCESS;
638 }
639 
640 static uint8_t avrcp_target_response_vendor_dependent_supported_events(avrcp_connection_t * connection){
641     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_CAPABILITIES);
642 
643     uint8_t event_id;
644     uint8_t num_events = 0;
645     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
646         if ((connection->notifications_supported_by_target & (1 << event_id)) == 0){
647             continue;
648         }
649         num_events++;
650     }
651 
652     connection->data[0] = AVRCP_CAPABILITY_ID_EVENT;
653     connection->data[1] = num_events;
654     connection->data_len = 2 + num_events;
655 
656     // fill the data later directly to the L2CAP outgoing buffer
657     connection->state = AVCTP_W2_SEND_RESPONSE;
658     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
659     return ERROR_CODE_SUCCESS;
660 }
661 
662 static uint8_t avrcp_target_response_vendor_dependent_supported_companies(avrcp_connection_t * connection){
663     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_CAPABILITIES);
664 
665     connection->data[0] = AVRCP_CAPABILITY_ID_COMPANY;
666     if (connection->target_supported_companies_num == 0){
667         connection->target_supported_companies_num = 1;
668         connection->target_supported_companies = default_companies;
669     }
670 
671     connection->data[1] = connection->target_supported_companies_num;
672     connection->data_len = 2 + connection->data[1] * 3;
673 
674     // fill the data later directly to the L2CAP outgoing buffer and
675     // use Bluetooth SIG as default company
676     connection->state = AVCTP_W2_SEND_RESPONSE;
677     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
678     return ERROR_CODE_SUCCESS;
679 }
680 
681 uint8_t avrcp_target_support_event(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
682     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
683     if (!connection){
684         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
685     }
686 
687     if ((event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
688         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
689     }
690 
691     connection->notifications_supported_by_target |= (1 << (uint8_t)event_id);
692     return ERROR_CODE_SUCCESS;
693 }
694 
695 uint8_t avrcp_target_support_companies(uint16_t avrcp_cid, uint8_t num_companies, const uint32_t *companies){
696     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
697     if (!connection){
698         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
699     }
700 
701     connection->target_supported_companies_num = num_companies;
702     connection->target_supported_companies     = companies;
703     return ERROR_CODE_SUCCESS;
704 }
705 
706 // TODO Review (use flags)
707 uint8_t avrcp_target_play_status(uint16_t avrcp_cid, uint32_t song_length_ms, uint32_t song_position_ms, avrcp_playback_status_t play_status){
708     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
709     if (!connection){
710         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
711     }
712     if (connection->state != AVCTP_CONNECTION_OPENED){
713         return ERROR_CODE_COMMAND_DISALLOWED;
714     }
715 
716     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_PLAY_STATUS);
717     connection->data_len = 9;
718     big_endian_store_32(connection->data, 0, song_length_ms);
719     big_endian_store_32(connection->data, 4, song_position_ms);
720     connection->data[8] = play_status;
721 
722     connection->state = AVCTP_W2_SEND_RESPONSE;
723     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
724     return ERROR_CODE_SUCCESS;
725 }
726 
727 static uint8_t avrcp_target_store_media_attr(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id, const char * value){
728     int index = attr_id - 1;
729     if (!value) return AVRCP_STATUS_INVALID_PARAMETER;
730     connection->target_now_playing_info[index].value = (uint8_t*)value;
731     connection->target_now_playing_info[index].len   = strlen(value);
732     return ERROR_CODE_SUCCESS;
733 }
734 
735 uint8_t avrcp_target_set_playback_status(uint16_t avrcp_cid, avrcp_playback_status_t playback_status){
736     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
737     if (!connection){
738         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
739     }
740     if (connection->target_playback_status == playback_status){
741         return ERROR_CODE_SUCCESS;
742     }
743 
744     connection->target_playback_status = playback_status;
745     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED)) {
746         connection->target_playback_status_changed = true;
747         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
748     }
749     return ERROR_CODE_SUCCESS;
750 }
751 
752 static void avrcp_target_register_track_changed(avrcp_connection_t * connection, const uint8_t * track_id){
753     if (track_id == NULL){
754         memset(connection->target_track_id, 0xFF, 8);
755         connection->target_track_selected = false;
756     } else {
757         (void)memcpy(connection->target_track_id, track_id, 8);
758         connection->target_track_selected = true;
759     }
760 
761     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED)) {
762         connection->target_track_changed = true;
763         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
764     }
765 }
766 
767 uint8_t avrcp_target_track_changed(uint16_t avrcp_cid, uint8_t * track_id){
768     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
769     if (!connection){
770         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
771     }
772     avrcp_target_register_track_changed(connection, track_id);
773     return ERROR_CODE_SUCCESS;
774 }
775 
776 uint8_t avrcp_target_set_now_playing_info(uint16_t avrcp_cid, const avrcp_track_t * current_track, uint16_t total_tracks){
777     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
778     if (!connection){
779         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
780     }
781     if (!current_track){
782         return ERROR_CODE_COMMAND_DISALLOWED;
783     }
784 
785     (void)memcpy(connection->target_track_id, current_track->track_id, 8);
786     connection->target_song_length_ms = current_track->song_length_ms;
787     connection->target_track_nr = current_track->track_nr;
788     connection->target_total_tracks = total_tracks;
789     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_TITLE, current_track->title);
790     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_ARTIST, current_track->artist);
791     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_ALBUM, current_track->album);
792     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_GENRE, current_track->genre);
793 
794     avrcp_target_register_track_changed(connection, current_track->track_id);
795     return ERROR_CODE_SUCCESS;
796 }
797 
798 
799 uint8_t avrcp_target_playing_content_changed(uint16_t avrcp_cid){
800     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
801     if (!connection){
802         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
803     }
804     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED)) {
805         connection->target_playing_content_changed = true;
806         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
807     }
808     return ERROR_CODE_SUCCESS;
809 }
810 
811 uint8_t avrcp_target_addressed_player_changed(uint16_t avrcp_cid, uint16_t player_id, uint16_t uid_counter){
812     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
813     if (!connection){
814         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
815     }
816 
817     if (connection->target_addressed_player_id == player_id){
818         return ERROR_CODE_SUCCESS;
819     }
820 
821     connection->target_uid_counter = uid_counter;
822     connection->target_addressed_player_id = player_id;
823 
824     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED)) {
825         connection->target_addressed_player_changed = true;
826         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
827     }
828     return ERROR_CODE_SUCCESS;
829 }
830 
831 uint8_t avrcp_target_battery_status_changed(uint16_t avrcp_cid, avrcp_battery_status_t battery_status){
832     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
833     if (!connection){
834         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
835     }
836     if (connection->target_battery_status == battery_status){
837         return ERROR_CODE_SUCCESS;
838     }
839 
840     connection->target_battery_status = battery_status;
841 
842     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED)) {
843         connection->target_battery_status_changed = true;
844         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
845     }
846     return ERROR_CODE_SUCCESS;
847 }
848 
849 uint8_t avrcp_target_adjust_absolute_volume(uint16_t avrcp_cid, uint8_t absolute_volume){
850     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
851     if (!connection){
852         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
853     }
854 
855     connection->target_absolute_volume = absolute_volume;
856     return ERROR_CODE_SUCCESS;
857 }
858 
859 uint8_t avrcp_target_volume_changed(uint16_t avrcp_cid, uint8_t absolute_volume){
860     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
861     if (!connection){
862         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
863     }
864     if (connection->target_absolute_volume == absolute_volume){
865         return ERROR_CODE_SUCCESS;
866     }
867 
868     connection->target_absolute_volume = absolute_volume;
869 
870     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED )) {
871         connection->target_notify_absolute_volume_changed = true;
872         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
873     }
874     return ERROR_CODE_SUCCESS;
875 }
876 
877 static void avrcp_target_set_transaction_label_for_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification, uint8_t transaction_label){
878     if (notification > AVRCP_NOTIFICATION_EVENT_MAX_VALUE) return;
879     connection->target_notifications_transaction_label[notification] = transaction_label;
880 }
881 
882 static uint8_t avrcp_target_get_transaction_label_for_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification){
883     if (notification > AVRCP_NOTIFICATION_EVENT_MAX_VALUE) return 0;
884     return connection->target_notifications_transaction_label[notification];
885 }
886 
887 static bool avcrp_operation_id_is_valid(avrcp_operation_id_t operation_id){
888     if (operation_id < AVRCP_OPERATION_ID_RESERVED_1) return true;
889 
890     if (operation_id < AVRCP_OPERATION_ID_0) return false;
891     if (operation_id < AVRCP_OPERATION_ID_RESERVED_2) return true;
892 
893     if (operation_id < AVRCP_OPERATION_ID_CHANNEL_UP) return false;
894     if (operation_id < AVRCP_OPERATION_ID_RESERVED_3) return true;
895 
896     if (operation_id < AVRCP_OPERATION_ID_CHANNEL_UP) return false;
897     if (operation_id < AVRCP_OPERATION_ID_RESERVED_3) return true;
898 
899     if (operation_id < AVRCP_OPERATION_ID_SKIP) return false;
900     if (operation_id == AVRCP_OPERATION_ID_SKIP) return true;
901 
902     if (operation_id < AVRCP_OPERATION_ID_POWER) return false;
903     if (operation_id < AVRCP_OPERATION_ID_RESERVED_4) return true;
904 
905     if (operation_id < AVRCP_OPERATION_ID_ANGLE) return false;
906     if (operation_id < AVRCP_OPERATION_ID_RESERVED_5) return true;
907 
908     if (operation_id < AVRCP_OPERATION_ID_F1) return false;
909     if (operation_id < AVRCP_OPERATION_ID_RESERVED_6) return true;
910 
911     return false;
912 }
913 
914 
915 #ifdef ENABLE_AVCTP_FRAGMENTATION
916 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
917     // after header (transaction label and packet type)
918     uint16_t pos;
919     uint16_t bytes_to_store;
920 
921     switch (packet_type){
922         case AVCTP_START_PACKET:
923             if (size < 2) return;
924 
925             // store header
926             pos = 0;
927             connection->avctp_reassembly_buffer[pos] = packet[pos];
928             pos++;
929             connection->avctp_reassembly_size = pos;
930 
931             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
932             pos++;
933 
934             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
935 
936             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
937             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
938             connection->avctp_reassembly_size += bytes_to_store;
939             break;
940 
941         case AVCTP_CONTINUE_PACKET:
942         case AVCTP_END_PACKET:
943             if (size < 1) return;
944 
945             // store remaining data, ignore header
946             pos = 1;
947             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
948             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
949             connection->avctp_reassembly_size += bytes_to_store;
950             break;
951 
952         default:
953             return;
954     }
955 }
956 #endif
957 
958 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t * packet, uint16_t size){
959     uint8_t avctp_header = packet[0];
960     connection->transaction_id = avctp_header >> 4;
961 
962     avctp_packet_type_t avctp_packet_type = (avctp_packet_type_t) ((avctp_header & 0x0F) >> 2);
963     switch (avctp_packet_type){
964         case AVCTP_SINGLE_PACKET:
965             break;
966 
967 #ifdef ENABLE_AVCTP_FRAGMENTATION
968         case AVCTP_START_PACKET:
969         case AVCTP_CONTINUE_PACKET:
970             avctp_reassemble_message(connection, avctp_packet_type, packet, size);
971             return;
972 
973         case AVCTP_END_PACKET:
974             avctp_reassemble_message(connection, avctp_packet_type, packet, size);
975 
976             packet = connection->avctp_reassembly_buffer;
977             size   = connection->avctp_reassembly_size;
978             break;
979 #endif
980         default:
981             return;
982     }
983 
984     if (size < 6u) return;
985 
986     uint16_t pid = big_endian_read_16(packet, 1);
987 
988     if (pid != BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL){
989         log_info("Invalid pid 0x%02x, expected 0x%02x", pid, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL);
990         connection->target_reject_transport_header = true;
991         connection->target_invalid_pid = pid;
992         connection->state = AVCTP_W2_SEND_RESPONSE;
993         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
994         return;
995     }
996 
997     // avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (packet[4] >> 3);
998     // avrcp_subunit_id_t   subunit_id   = (avrcp_subunit_id_t) (packet[4] & 0x07);
999 
1000     avrcp_command_opcode_t opcode = (avrcp_command_opcode_t) avrcp_cmd_opcode(packet,size);
1001 
1002     int pos = 6;
1003     uint16_t length;
1004     avrcp_pdu_id_t   pdu_id;
1005     // connection->data_len = 0;
1006     uint8_t offset;
1007     uint8_t operand;
1008     uint16_t event_mask;
1009     avrcp_operation_id_t operation_id;
1010 
1011     switch (opcode){
1012         case AVRCP_CMD_OPCODE_UNIT_INFO:
1013             avrcp_target_unit_info(connection);
1014             break;
1015         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
1016             if ((size - pos) < 3) return;
1017             // page: packet[pos] >> 4,
1018             offset =  4 * (packet[pos]>>4);
1019             // extension code (fixed 7) = packet[pos] & 0x0F
1020             // 4 bytes paga data, all 0xFF
1021             avrcp_target_subunit_info(connection, offset);
1022             break;
1023 
1024         case AVRCP_CMD_OPCODE_PASS_THROUGH:
1025             if (size < 8) return;
1026             log_info("AVRCP_OPERATION_ID 0x%02x, operands length %d", packet[6], packet[7]);
1027             operation_id = (avrcp_operation_id_t) (packet[6] & 0x7f);
1028             operand = 0;
1029             if ((packet[7] >= 1) && (size >= 9)){
1030                 operand = packet[8];
1031             }
1032 
1033             if (avcrp_operation_id_is_valid(operation_id)){
1034                 bool button_pressed = (packet[6] & 0x80) == 0;
1035 
1036                 avrcp_target_operation_accepted(connection->avrcp_cid, (avrcp_operation_id_t) packet[6], packet[7], operand);
1037                 avrcp_target_emit_operation(avrcp_target_context.avrcp_callback, connection->avrcp_cid,
1038                                                 operation_id, button_pressed, packet[7], operand);
1039             } else {
1040                 avrcp_target_operation_not_implemented(connection->avrcp_cid, (avrcp_operation_id_t) packet[6], packet[7], operand);
1041             }
1042             break;
1043 
1044 
1045         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
1046 
1047             if (size < 13) return;
1048 
1049             // pos = 6 - company id
1050             (void)memcpy(connection->message_body, &packet[pos], 3);
1051             // connection->data_len = 3;
1052             pos += 3;
1053             // pos = 9
1054             pdu_id = (avrcp_pdu_id_t) packet[pos++];
1055             // 1 - reserved
1056             pos++;
1057             // 2-3 param length,
1058             length = big_endian_read_16(packet, pos);
1059             pos += 2;
1060             // pos = 13
1061             switch (pdu_id){
1062                 case AVRCP_PDU_ID_SET_ADDRESSED_PLAYER:{
1063                     if ((pos + 2) > size) return;
1064                     bool ok = length == 4;
1065                     if (avrcp_target_context.set_addressed_player_callback != NULL){
1066                         uint16_t player_id = big_endian_read_16(packet, pos);
1067                         ok = avrcp_target_context.set_addressed_player_callback(player_id);
1068                     }
1069                     if (ok){
1070                         avrcp_target_vendor_dependent_response_accept(connection, pdu_id, AVRCP_STATUS_SUCCESS);
1071                     } else {
1072                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PLAYER_ID);
1073                     }
1074                     break;
1075                 }
1076                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
1077                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos];
1078                     switch (capability_id){
1079                         case AVRCP_CAPABILITY_ID_EVENT:
1080                              avrcp_target_response_vendor_dependent_supported_events(connection);
1081                             break;
1082                         case AVRCP_CAPABILITY_ID_COMPANY:
1083                             avrcp_target_response_vendor_dependent_supported_companies(connection);
1084                             break;
1085                         default:
1086                             avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1087                             break;
1088                     }
1089                     break;
1090                 }
1091                 case AVRCP_PDU_ID_GET_PLAY_STATUS:
1092                     avrcp_target_emit_respond_vendor_dependent_query(avrcp_target_context.avrcp_callback, connection->avrcp_cid, AVRCP_SUBEVENT_PLAY_STATUS_QUERY);
1093                     break;
1094                 case AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE:
1095                     if ((pos + 1) > size) return;
1096                     connection->target_abort_continue_response = true;
1097                     connection->state = AVCTP_W2_SEND_RESPONSE;
1098                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1099                     break;
1100                 case AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE:
1101                     if ((pos + 1) > size) return;
1102                     if (packet[pos] != AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES){
1103                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1104                         return;
1105                     }
1106                     connection->target_continue_response = true;
1107                     connection->target_now_playing_info_response = true;
1108                     connection->state = AVCTP_W2_SEND_RESPONSE;
1109                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1110                     break;
1111                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:{
1112                     if ((pos + 9) > size) return;
1113                     uint8_t play_identifier[8];
1114                     memset(play_identifier, 0, 8);
1115                     if (memcmp(&packet[pos], play_identifier, 8) != 0) {
1116                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1117                         return;
1118                     }
1119                     pos += 8;
1120                     uint8_t attribute_count = packet[pos++];
1121                     connection->next_attr_id = AVRCP_MEDIA_ATTR_NONE;
1122                     if (!attribute_count){
1123                         connection->next_attr_id = AVRCP_MEDIA_ATTR_TITLE;
1124                         connection->target_now_playing_info_attr_bitmap = 0xFE;
1125                     } else {
1126                         int i;
1127                         connection->next_attr_id = AVRCP_MEDIA_ATTR_TITLE;
1128                         connection->target_now_playing_info_attr_bitmap = 0;
1129                         if ((pos + attribute_count * 4) > size) return;
1130                         for (i=0; i < attribute_count; i++){
1131                             uint32_t attr_id = big_endian_read_32(packet, pos);
1132                             connection->target_now_playing_info_attr_bitmap |= (1 << attr_id);
1133                             pos += 4;
1134                         }
1135                     }
1136                     log_info("target_now_playing_info_attr_bitmap 0x%02x", connection->target_now_playing_info_attr_bitmap);
1137                     connection->target_now_playing_info_response = true;
1138                     connection->state = AVCTP_W2_SEND_RESPONSE;
1139                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1140                     break;
1141                 }
1142                 case AVRCP_PDU_ID_REGISTER_NOTIFICATION:{
1143                     if ((pos + 1) > size) return;
1144                     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) packet[pos];
1145 
1146                     avrcp_target_set_transaction_label_for_notification(connection, event_id, connection->transaction_id);
1147 
1148                     if (event_id < AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED ||
1149                         event_id > AVRCP_NOTIFICATION_EVENT_MAX_VALUE){
1150                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1151                         return;
1152                     }
1153 
1154                     switch (event_id){
1155                         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:
1156                         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
1157                         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:
1158                         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:
1159                         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:
1160                         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:
1161                         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:
1162                         case AVRCP_NOTIFICATION_EVENT_MAX_VALUE:
1163                             avrcp_target_response_vendor_dependent_not_implemented(connection, pdu_id, event_id);
1164                             return;
1165                         default:
1166                             break;
1167                     }
1168 
1169                     event_mask = (1 << event_id);
1170                     connection->notifications_enabled |= event_mask;
1171 
1172                     switch (event_id){
1173                         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:
1174                             if (connection->target_track_selected){
1175                                 avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, AVRCP_NOTIFICATION_TRACK_SELECTED, 8);
1176                             } else {
1177                                 avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, AVRCP_NOTIFICATION_TRACK_NOT_SELECTED, 8);
1178                             }
1179                             break;
1180                         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:
1181                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->target_playback_status, 1);
1182                             break;
1183                         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:
1184                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, NULL, 0);
1185                             break;
1186                         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:
1187                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->target_absolute_volume, 1);
1188                             break;
1189                         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:
1190                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->target_battery_status, 1);
1191                             break;
1192                         case AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED:
1193                             avrcp_target_response_addressed_player_changed_interim(connection, pdu_id, event_id);
1194                             return;
1195                         default:
1196                             btstack_assert(false);
1197                             return;
1198                     }
1199                     break;
1200                 }
1201                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME: {
1202                     if ( (length != 1) || ((pos + 1) > size)){
1203                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1204                         break;
1205                     }
1206 
1207                     uint8_t absolute_volume = packet[pos];
1208                     if (absolute_volume < 0x80){
1209                         connection->target_absolute_volume = absolute_volume;
1210                     }
1211                     avrcp_target_emit_volume_changed(avrcp_target_context.avrcp_callback, connection->avrcp_cid, connection->target_absolute_volume);
1212                     avrcp_target_vendor_dependent_response_accept(connection, pdu_id, connection->target_absolute_volume);
1213                     break;
1214                 }
1215                 default:
1216                     log_info("AVRCP target: unhandled pdu id 0x%02x", pdu_id);
1217                     avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1218                     break;
1219             }
1220             break;
1221         default:
1222             log_info("AVRCP target: opcode 0x%02x not implemented", avrcp_cmd_opcode(packet,size));
1223             break;
1224     }
1225 }
1226 
1227 static void avrcp_target_notification_init(avrcp_connection_t * connection, avrcp_notification_event_id_t notification_id, uint8_t * value, uint16_t value_len){
1228     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_CHANGED_STABLE, AVRCP_PDU_ID_REGISTER_NOTIFICATION);
1229     connection->transaction_id = avrcp_target_get_transaction_label_for_notification(connection, notification_id);
1230 
1231     connection->data_len = 1 + value_len;
1232     connection->data[0] = notification_id;
1233     if (value != NULL){
1234         (void)memcpy(connection->data + 1, value, value_len);
1235     }
1236 }
1237 
1238 static void avrcp_target_notification_addressed_player_changed_init(avrcp_connection_t * connection){
1239     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_CHANGED_STABLE, AVRCP_PDU_ID_REGISTER_NOTIFICATION);
1240     connection->transaction_id = avrcp_target_get_transaction_label_for_notification(connection, AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED);
1241 
1242     connection->data_len = 5;
1243     connection->data[0] = AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED;
1244     big_endian_store_16(connection->data, 1, connection->target_addressed_player_id);
1245     big_endian_store_16(connection->data, 3, connection->target_uid_counter);
1246 }
1247 
1248 
1249 static void avrcp_target_reset_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification_id){
1250     if (notification_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX || notification_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX){
1251         return;
1252     }
1253     connection->notifications_enabled &= ~(1 << notification_id);
1254     connection->target_notifications_transaction_label[notification_id] = 0;
1255 }
1256 
1257 static void avrcp_request_next_avctp_segment(avrcp_connection_t * connection){
1258     // AVCTP
1259     switch (connection->avctp_packet_type){
1260         case AVCTP_END_PACKET:
1261         case AVCTP_SINGLE_PACKET:
1262             connection->state = AVCTP_CONNECTION_OPENED;
1263             break;
1264         default:
1265             connection->state = AVCTP_W2_SEND_RESPONSE;
1266             avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1267             break;
1268     }
1269 }
1270 
1271 static void avrcp_target_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1272     avrcp_connection_t * connection;
1273     avrcp_notification_event_id_t notification_id = AVRCP_NOTIFICATION_EVENT_NONE;
1274 
1275     switch (packet_type){
1276         case L2CAP_DATA_PACKET:
1277             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, channel);
1278             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1279             return;
1280 
1281         case HCI_EVENT_PACKET:
1282             if (hci_event_packet_get_type(packet) != L2CAP_EVENT_CAN_SEND_NOW){
1283                 return;
1284             }
1285 
1286             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, channel);
1287             if (connection == NULL){
1288                 return;
1289             }
1290 
1291             if (connection->state == AVCTP_W2_SEND_RESPONSE){
1292                 // start AVCTP
1293                 if (connection->target_reject_transport_header){
1294                     connection->target_reject_transport_header = false;
1295                     avctp_send_reject_cmd_wrong_pid(connection);
1296                     connection->state = AVCTP_CONNECTION_OPENED;
1297                     return;
1298                 }
1299                 // end AVCTP
1300 
1301                 // start AVRCP
1302                 if (connection->target_abort_continue_response){
1303                     connection->target_abort_continue_response = false;
1304                     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE);
1305                     break;
1306                 }
1307 
1308                 if (connection->target_now_playing_info_response){
1309                     connection->target_now_playing_info_response = false;
1310                     if (connection->target_continue_response){
1311                         connection->target_continue_response = false;
1312                         if (connection->data_len == 0){
1313                             avrcp_target_response_vendor_dependent_reject(connection, connection->pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1314                             return;
1315                         }
1316                     } else {
1317                         avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES);
1318                         connection->data_len = avrcp_now_playing_info_value_len_with_headers(connection);
1319                     }
1320                     break;
1321                 }
1322 
1323                 // data already prepared
1324                 break;
1325             }
1326 
1327             // Notifications
1328 
1329             if (connection->target_track_changed){
1330                 connection->target_track_changed = false;
1331                 notification_id = AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED;
1332                 avrcp_target_notification_init(connection, notification_id, connection->target_track_id, 8);
1333                 break;
1334             }
1335 
1336             if (connection->target_playback_status_changed){
1337                 connection->target_playback_status_changed = false;
1338                 notification_id = AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED;
1339                 uint8_t playback_status = (uint8_t) connection->target_playback_status;
1340                 avrcp_target_notification_init(connection, notification_id, &playback_status, 1);
1341                 break;
1342             }
1343 
1344             if (connection->target_playing_content_changed){
1345                 connection->target_playing_content_changed = false;
1346                 notification_id = AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED;
1347                 avrcp_target_notification_init(connection, notification_id, NULL, 0);
1348                 break;
1349             }
1350 
1351             if (connection->target_battery_status_changed){
1352                 connection->target_battery_status_changed = false;
1353                 notification_id = AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
1354                 avrcp_target_notification_init(connection, notification_id, (uint8_t *)&connection->target_battery_status, 1);
1355                 break;
1356             }
1357 
1358             if (connection->target_notify_absolute_volume_changed){
1359                 connection->target_notify_absolute_volume_changed = false;
1360                 notification_id = AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED;
1361                 avrcp_target_notification_init(connection, notification_id, &connection->target_absolute_volume, 1);
1362                 break;
1363             }
1364 
1365             if (connection->target_addressed_player_changed){
1366                 connection->target_addressed_player_changed = false;
1367                 notification_id = AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED;
1368                 avrcp_target_notification_addressed_player_changed_init(connection);
1369                 break;
1370             }
1371 
1372             // nothing to send, exit
1373             return;
1374 
1375         default:
1376             return;
1377     }
1378 
1379     avrcp_send_response_with_avctp_fragmentation(connection);
1380     avrcp_target_reset_notification(connection, notification_id);
1381     avrcp_request_next_avctp_segment(connection);
1382 }
1383 
1384 void avrcp_target_init(void){
1385     avrcp_target_context.role = AVRCP_TARGET;
1386     avrcp_target_context.packet_handler = avrcp_target_packet_handler;
1387     avrcp_register_target_packet_handler(&avrcp_target_packet_handler);
1388 }
1389 
1390 void avrcp_target_deinit(void){
1391     memset(&avrcp_target_context, 0, sizeof(avrcp_context_t));
1392 }
1393 
1394 void avrcp_target_register_packet_handler(btstack_packet_handler_t callback){
1395     btstack_assert(callback != NULL);
1396     avrcp_target_context.avrcp_callback = callback;
1397 }
1398 
1399 void avrcp_target_register_set_addressed_player_handler(bool (*callback)(uint16_t player_id)){
1400     btstack_assert(callback != NULL);
1401     avrcp_target_context.set_addressed_player_callback = callback;
1402 }
1403 
1404 
1405